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Vtificate and any accompanying documents has re-registered under the Companies Act 
the same name as that with which it was registered immediately before re- 
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fificate and any accompanying documents shall be treated as references to the name 
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with the rules, the words "public limited company" may be replaced by p. 
lor PLC. 
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|regisn»n under the Companies Act does not constitute a new legal entity but merely 
|ects tlBpmpany to certain additional company law rules. 
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Fault Monitoring System 

This invention relates to a fault monitoring system for providing an 
indication of the presence of faults detected in, for example, a system for 
monitoring operating parameters within an aircraft. 

In a known fault monitoring system, in order to discriminate between 
intermittent and persistent or "hard" faults, an operating parameter is 
checked for the presence of a fault during successive sampling periods which 
may be, for example, at one second intervals. An integrator is provided 
which counts or ramps upwards towards a fault confirmation threshold every 
time a fault is sensed and counts or ramps downwards between sampling 
periods in which no fault is sensed. The integrator has an integration ratio 
which is such that for every upward count consequent on a fault detection, 
there are N fault free sampling periods for an equivalent downward count. 
For example, if a system has a fault confirmation threshold of 30, a sample 
rate of one second and an integration ratio of 1 : 50, a fault will be confirmed 
as a hard fault after 30 samples, i.e. 30 seconds. That is to say, the hard 
fault is confirmed once the mtegrator reaches a preset count or threshold, in 
this case 30. The system engineer can then investigate the fault in the 
knowledge that the fault has been declared "hard" and should therefore be 
reproducible/ visible during fault isolation. Clearly, the fastest descent 
possible from the maximum count of 30 to zero in the case where successive 
samples are fault-free following confirmation of a "hard" fault, will take 
30x50 seconds. 

If the fault is intermittent, in which some sampled periods will indicate 
the presence of a fault while others will not, the integrator will count up and 
down according to the ratio of fault to non-fault sampling periods having 
regard to the integration ratio. Hence, an intermittent fault with a ratio of 



greater than one fault in 50 samples will eventually be confirmed as a hard 
fault. Depending of the degree of intermittency, the integrator may reach 
and move away from the preset count or threshold periodically. The system 
is therefore capable of registering such events as recurrent intermittent faults. 
Whether it does so, or registers them as confirmed hard faults depends on 
whether the fault is steady or periodically random. For example, in the case 
where the degree of intermittency is low, but not so low relative to the 
integration ratio that the integrator never reaches the preset count, the preset 
count threshold may only be reached after a long period of time. When 
reached, the system will indicate the presence of a confirmed hard fault even 
though the fault is essentially a very intermittent one. For an intermittent 
fault occurring less frequently than the integrator ratio, the integrator will 
never reach the preset count and no hard fault or intermittent fault will be 
confirmed by the system, ensuring that those faults that have no effect on the 
functionality are ignored. 

Currently, the fault detection system may determine whether a fault is 
intermittent or persistent (hard) by counting the number of times that the 
integration count reaches a threshold value. If a count reaches a threshold 
only once then it is recorded as a hard fault and is flagged as such by the 
detection system. If the count reaches the threshold more than once then the 
fault is flagged as intermittent. Such a system has the disadvantage that the 
type of intermittency is not recorded. Also intermittent faults which take a 
considerable time to integrate to the threshold value may never reach the 
threshold a second time in order to be classified as intermittent and are 
therefore flagged by the system as hard. If the fault is classified as hard, the 
system engineer will expect the fault to be visible during fault isolation and as 
a consequence may reject the wrong component if unable to confirm a 
continuity fault. The problem is particularly seen in the case of thermocouple 
temperature sensors. These devices generate signals of the order of only a 



few mV and are therefore particularly prone to intermittent connection 
problems. With the increased functionality and complexity of modern 
electronic controllers comes an increase in the number of nuisance messages 
generated by low intermittency faults. These faults often have no system 
effect but result in the rejection of the electronic controller due to poor 
troubleshooting. 

One solution to this could be to 'mask' the problem by increasing the 
thresholds at which an intermittent fault is registered as 'hard' . In the 
integrator system described previously, this could be done by increasing the 
integrator threshold from 30 to, say, 40. Any change to the fault integration 
system must be made in the knowledge that the system is tolerant to the fault 
for the period in which the fault condition is active prior to detection. This is 
often a very difficult analysis to complete. 

It is an aim of the present invention to provide a fault monitoring 
system that can provide the systems engineer with a more robust system for 
determining and distinguishing between intermittent and hard faults. In 
particular, it is an aim of the present invention to provide the engineer with 
information about the nature of the intermittent fault which will permit him to 
make a more informed decision as to what, if any, action is required in 
response thereto. It is also an aim of the present invention to make this 
information available to the systems engineer prior to fault annunciation by 
the control system. The engineer will therefore have a basis for monitoring 
the 'general health 1 of the system being monitored on an ongoing real-time 
basis. 

According to the present invention, there is provided a fault 
monitoring system comprising a fault detection mechanism to determine the 
status of a parameter to be monitored, an integrator for counting in one 



direction when a fault in the measurement system is detected and for 
counting in an opposite direction in the absence of fault detection, a threshold 
detector for generating a hard fault indication when the integrator count 
reaches a threshold value, and an integrator count monitor for generating 
information indicative of the state of the integrator count when below the 
threshold value thereby to provide an indication of the progression of the 
fault. 

The counting in the one direction may be at a rate equal to or higher 
than the rate of counting in the opposite direction. 

In embodiments of the present invention, it is possible to monitor the 
progress of the sensed faults prior to the generation of a hard or confirmed 
fault message. Consequently, embodiments of the invention have the 
advantage that they provide an indication of the state of health of the system 
being monitored. Embodiments provide for the monitoring of trends in the 
fault counts of intermittent faults enabling prediction of specific failure 
conditions. More particularly, by correlating the progression of the sensed 
faults with system operating parameters, it is possible to relate the sensed 
fault to possible causes. This enables provision of a fault diagnostic 
capability. For example, if the fault occurs only when vibration levels are 
high, which may be the case during take off of an aircraft, the fault indication 
could be indicative of an impending connector failure. Steps may be taken to 
remedy the fault before actual failure of the component. Other fault 
indications may arise which indicate conditions not likely to result in a 
degrading performance or system failure in which case the system engineer, 
armed with more information, can decide whether remedial action is 
appropriate. 
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In a preferred embodiment of the present invention, the integrator 
count monitor generates an indication of the ratio between the count in one 
direction and the count in the opposite direction for providing the information 
as to the progression of the sensed fault towards or away from a hard or 
intermittent fault condition. In this case, the ratio may be averaged over a 
predetermined period of time or for the duration of a specified system 
operating condition. For example, if the ratio of the integrator count in the 
one direction to the count in the opposite direction is only high during 
specific operating conditions of an aircraft, it is possible that the fault is 
indicative of a failure mechanism made apparent due to high levels of 
vibration at these times. The system may thus be provided with means for 
correlating the information generated by the integrator count monitor with 
system operating conditions and so provide fault status or diagnostic 
information in response to the correlation. 

In an alternative embodiment to reduce the requirement for data 
transfer to a health monitoring system, the integrator count monitor may 
generate further indication dependent on the integrator count relative to a 
sub-threshold value, which is set below the nominal threshold value. In this 
case, the information indicative of the state of the integrator count may be 
any one of: the frequency with which the integrator count exceeds the sub- 
threshold value; the total time this sub-threshold value is exceeded; the 
maximum continuous period the integrator count exceeds the sub-threshold. 
As with the first embodiment, the information indicative of the state of the 
integrator may be correlated with operating phases of the system and the 
system may be operative to generate appropriate system health messages. 

The invention will now be further described by way of example with 
reference to the accompanying drawings in which: 
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Figure 1 is a flow chart with reference to which a prior art fault 
monitoring system will be described; 

Figure 2a is a graph illustrating the integrator count for two different 
fault scenarios in the prior art system of Figure 1; 

Figures 2b to 2e show, for illustrative purposes, four different fault 
scenarios according to a different integrator count regime from that of figure 
2a; 

Figure 3 is a flow chart with reference to which a first embodiment of 
the invention will be described; 

Figure 4 is a flow chart with reference to which a second embodiment 
of the present invention will be described; and 

Figure 5 is a graph showing the progression of integrator counts in the 
embodiment of Figure 4. 

A prior art fault monitoring system comprises an integrator which 
counts upwardly towards a threshold value (see Z of Figure 2a) each time a 
fault is detected during a sampling period. The prior art fault monitoring 
system is initialised with the integrator value at zero as indicated in step 1 of 
Figure 1 and shown as point A in Figure 2a. The system reads at step 2 a 
signal received from a transducer providing a measure of the input parameter 
being monitored. At step 3, the received signal is validated using one or 
more fault detection methods. Range checks, cross-checks and model checks 
are often used in combination to ensure high integrity fault detection. Step 4 
determines whether the received signal is indicative of the existence of a 
fault. If a fault is identified at step 4, a check is made at step 5 to see 



whether or not the integrator count is greater than or equal to the threshold 
Z. If the integrator count is greater than or equal to the threshold value Z, 
then an affirmative indication Y restarts the signal check routine. In this 
way, the fault count is prevented from exceeding the threshold. If the 
integrator count is less than Z, the integrator count is upwardly incremented 
at step 6 by a value X equivalent to the up-count of the integrator. At step 7, 
the upwardly incremented count value is checked again whether it is greater 
than or equal to the threshold value Z. An affirmative result is confirmed as 
a hard fault at step 8 otherwise the incremented integrated count value is 
stored and the routine restarted to check the presence of a fault in the next 
sample. In the next sample, it is possible that step 4 determines the absence 
of a fault, in which case the system is operative at step 9 to check whether 
the current indicator count value is greater than or equal to the down count 
value Y. If the integrator count value is currently not greater than or equal to 
the down count value Y, then in order to avoid a negative count, the system 
routine is restarted in readiness for the next signal sample. On the other 
hand, if at step 9 the current integrator count value is determined as being 
greater than or equal to the down count Y, then the integrator count value is 
decremented by Y at step 10. 

Figure 2a illustrates two possible count profiles for the system 
described with reference to Figure 1. In this system, the integrator has an 
integration ratio of 1:50 and a threshold value Z of 30. If the signal sampling 
is at the rate of one sample per second (see count profile i of Figure 2a), then 
the minimum time it takes the system to confirm a fault is 30 seconds, that is 
to say the time for the count to move from point A of Figure 2a to point B. 
The integration ratio of 1 : 50 means that there must be 50 no-fault samples to 
achieve an equivalent downward count. In this case, the minimum time for 
the integrator to return from the threshold value B to zero at point C of 
Figure 2a is 30x50 (i.e. twenty five minutes). In this example, the transducer 
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being monitored causes the integrator to meet the threshold value Z for a 
second time at point D. The fault monitoring system recognises the return of 
the integrator count value to the threshold value Z as an intermittent fault. 
The system therefore indicates the fault profile represented by the count 
profile i as a recurrent hard fault. 

An alternative fault scenario is indicated by the count profile ii of 
Figure 2a. In this case, the fault occurs for considerably shorter periods, i.e. 
it is more intermittent, but the ratio between fault and non-fault samples 
relative to the integrator ratio is such that over a long period of time the 
threshold Z is reached as indicated at point E of Figure 2a. In this case, the 
system indicates the presence of a hard fault even though the fault is 
essentially a very intermittent one. The prior art fault monitoring system 
therefore suffers from the disadvantage that it is not possible to distinguish 
properly between hard faults, hard recurrent faults and periodic intermittent 
faults. 

In Figures 2b to 2e, the integrator count is set for illustrative purposes 
so that there is an upward count of 5 for every fault sample and a downward 
count of 1 for every fault free sample. These figures illustrate four different 
fault scenarios respectively. In Figure 2b, a situation where a fault is 
permanent, i.e. 'hard 1 , is indicated. In Figure 2c, a situation where the fault 
is periodically intermittent over the long term is indicated but the character of 
the fault is such that the threshold is not reached. In this case, the system 
does not indicate the presence of a fault. Figures 2d and 2e illustrate two 
different intermittent fault scenarios which prior art systems cannot 
distinguish between. Both intermittent fault scenarios are such that the 
threshold is reached and the system indicates the presence of a fault. 
However, in the case of Figure 2d, the nature of the fault is such that it is 
intermittent over the long term, resulting in a hard fault indication. In 



contrast, the nature of the fault giving rise to the count profile illustrated in 
Figure 2e is such that it occurs persistently during particular engine operation 
phases only rather than consistently over the long term. This scenario is 
indicated as an intermittent fault. 

The flow chart of Figure 3 illustrates an embodiment of the invention 
in which the fault monitoring system is provided with means for measuring 
the trend of the integrator count towards and away from the threshold value. 
The fault monitoring system of Figure 3 performs similar steps to those 
described with reference to Figure 1 except that in steps 1 1 and 12, an 
absolute fault and no fault count is initiated and incremented at steps 13 and 
14 depending on whether or not a fault is determined at step 4. The ratio 
between the cumulative number of faults counted at step 13 to the cumulative 
number of non-faults counted at step 14 is calculated at step 15. It is 
therefore possible to record the trend in the ratio of the fault periods against 
the number of fault-free periods. This data trend is capable of indicating a 
worsening fault situation in which a hard fault would eventually be indicated 
by the system. The system may be operative for calculating the ratio of fault 
periods against non-fault periods over an entire operating sequence, for 
example an entire aircraft flight. In this case, the result would indicate the 
overall health of the parameter under review. A different type of indication 
such as a ratio of failures during a particular flight condition, such as take-off 
or descent may highlight transient effects such as vibration or temperature 
changes, which are more likely to be a factor influencing the generation of 
faults. The number of samples used to calculate the fault to non-fault ratio is 
a matter of design choice depending on the diagnostic objective and 
computing performance available. 
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An alternative embodiment is described with reference to Figure 4, 
with similar steps to those of Figures 1 and 3 and bearing similar reference 
numerals. In this case, only the steps leading from decision box 4 are shown 
in Figure 4 to highlight the differences between this method and that 
illustrated by Figure 3. In this alternative embodiment, instead of 
determining the ratio or gradient between upward and downward counts, the 
system is operative for providing an indication of the degree to which the 
integrator count value exceeds a lower integrator threshold or sub-threshold 
W (see Figure 5). In this embodiment, if no fault is sensed at decision box 4, 
it is determined at step 16 whether the integrator count is greater than the 
sub-threshold value W. If the result in step 16 is affirmative, a record of the 
time that the integrator count remains continuously above the threshold W is 
increased at step 17. At step 18, a count representing the total time the count 
is above threshold W is increased. In the event that the integrator count is 
determined at step 16 to have fallen below the sub-threshold W, the count is 
reset to zero at step 19. The system then proceeds to check at step 9 whether 
the integrator count can be decremented at step 10 as previously described 
with reference to Figure 1 . 

In the event that a fault is confirmed at step 4, the system determines 
at step 5 whether the integrator count is greater than or equal to the fault 
confirmation threshold Z as described hereinbefore with reference to Figure 
1 . If the integrator count is greater than or equal to the threshold Z then the 
system increments "the time above the sub-threshold W" and the "total time 
above the sub-threshold W" at steps 23 and 24. If the integrator count is not 
greater than or equal to the threshold Z at which a hard count is indicated, 
the integrator count is incremented at step 6 as hereinbefore described but 
there is a subsequent determination at step 20 as to whether the integrator 
count is greater than the sub-threshold W. If the count is greater, then the 
system increments the "time above the sub-threshold W" period and "total 
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time above the sub-threshold W" as indicated at steps 21 and 22 in a similar 
manner to that described hereinbefore in the case where no fault is detected 
in the system of Figure 4. 

As illustrated in Figure 5, the system is capable of providing a signal 
indicative of the total time the sensor fault count exceeds the sub-threshold W 
and also the time of each period that the fault count exceeds the threshold. 
These values may be used to give an indication of the general trends in 
intermittent faults before they become registered as hard faults on reaching 
the threshold Z. These data trends may be established by analysing the time 
periods calculated by the method illustrated by Figure 5, in different ways. 
For instance, the maximum continuous period above the sub-threshold W 
may be used, or the total time above this threshold. It is also possible to 
monitor the frequency of periods above the sub- threshold. An advantage of 
the embodiment described in Figure 5 is that the system provides an output 
indicative of the state of the system being sensed, while reducing the 
requirement for transferring an excessive quantity of data to be processed. 
The data trends determined may be correlated against the total flight time of 
an aircraft or with individual flight phases such as take-off or landing or 
flight events such as deployment of undercarriage, or other maintenance 
messages which may be received from health monitoring systems. 
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